The CyberWire Daily Briefing 09.03.15

Cyber Attacks, Threats, and Vulnerabilities

Anonymous Offshoot GhostSec Launches Another Phase of Attacks Against ISIS (HackRead) Another phase of an online battle against the members of the so-called Islamic State (IS, previously ISIS/ISIL) group has been launched throughout the world by the Anonymous hacktivists

Extreme Makeover, Jihadist Edition: Al-Qaeda's Rebranding Campaign (War on the Rocks) There is no love lost between al-Qaeda and the Islamic State. Al-Qaeda appears to be rolling out a very deliberate PR strategy against its erstwhile affiliate. Can the organization re-brand itself as the jihadi group the world can live with?

New Versions of Carbanak Banking Malware Seen Hitting Targets in U.S. and Europe (Threatpost) New variants of the notorious Carbanak Trojan have surfaced in Europe and the United States, and researchers say that the malware now has its own proprietary communications protocol and the samples seen so far have been digitally signed

RedHat security finds multiple network devices leak 'RSA-CRT' keys (CSO) A researcher has discovered certain implementations of the Transport Layer Security (TLS) protocol used to encrypt web traffic can leak RSA keys

Rapid7 research exposes internet of things security problems (ComputerWeekly) Security flaws exposed on internet-connected baby monitors indicate the poor state of consumer internet of things (IoT) security that businesses should not ignore, warns Rapid7

Adware installer gives itself permission to access Mac users' keychain (Help Net Security) Malwarebytes researcher Adam Thomas has made an interesting discovery: an adware installer created by Genieo, a well-known distributor of unwanted software, is taking advantage of an OS X feature to access information stored in the "Safari Extension List" in the users' keychain

Microsoft Word Intruder Revealed — inside a malware construction kit (Naked Security) Start thinking back, and bring to mind the big "Malware In The Media" stories of the last few years

Malware Author Stamped Code 'For Targeted Attacks Only' (Dark Reading) When the Microsoft Word Intruder Office malware creation kit got too high-profile, the developer changed terms of service, Sophos report says

Wikipedia blocks sockpuppet accounts amid blackmail claims (Naked Security) The Wikimedia Foundation (WMF), host of the online encyclopaedia, Wikipedia, announced on Monday that it has suspended 381 accounts for creating pages deemed to be either overly promotional in nature or featuring spam links

Victims of June OPM Hack Still Haven't Been Notified (Threatpost) Millions of government workers whose information was implicated in this year's expansive Office of Personnel Management hack still haven't been notified, the agency revealed this week

OPM (Mis)Spends $133M on Credit Monitoring (KrebsOnSecurity) The Office of Personnel Management (OPM) has awarded a $133 million contract to a private firm in an effort to provide credit monitoring services for three years to nearly 22 million people who had their Social Security numbers and other sensitive data stolen by cybercriminals. But perhaps the agency should be offering the option to pay for the cost that victims may incur in "freezing" their credit files, a much more effective way of preventing identity theft

Android ransomware uses XMPP chat to call home, claims it's from NSA (Ars Technica) Improved Simplocker lurks disguised as legitimate Flash or video player app

Ransomware Booms as Cyber Attackers' Method of Choice (SIGNAL) Eruption of connected devices, poor cyberhygiene contributed to the perfect storm

Greater Manchester Police website brought down by cyber attack from Lithuanian hacker (Mirror) The brazen hacker tweeted at the force claiming responsibility for the attack, which has been branded 'an act of internet vandalism'

How a simple email error revealed the identities of hundreds of HIV patients (Graham Cluley) Many of us have done it. Rather than emailing a long list of people using the Bcc field, we've used Cc instead

Cyber-security experts criticise data handling processes after HIV clinic email error (SC Magazine) Security experts have criticised the processes that allowed the names and email addresses of hundreds of HIV-positive patients in London to be revealed in an email newsletter

Car hacking risk may be broader than Fiat Chrysler (Money Market) The cybersecurity issues that led Fiat Chrysler Automobiles NV to recall 1.4 million vehicles in August could pose a problem for cars and trucks from other automakers, the top U.S. auto safety regulator said. Mark Rosekind, who heads the National Highway Traffic Safety Administration, said his watchdog agency is trying to determine how many car makers received wireless components from the same company that supplied Fiat Chrysler

Employees put business data at risk by installing gambling apps on their phones (IDG via CSO) Some companies have as many as 35 such apps in their environments, a study found

Lone Rangers of the Underground (Trend Micro) When we speak about online crime, we do so often in terms of "organised crime" or of highly-skilled nation-state sponsored activity

Security Patches, Mitigations, and Software Updates

Fortinet addresses four vulnerabilities in FortiClient (SC Magazine) Fortinet has released a firmware update for its endpoint security solution FortiClient that addresses four vulnerabilities

Internet Systems Consortium (ISC) Releases Security Updates for BIND (US-CERT) ISC has released security updates to address vulnerabilities in BIND. Exploitation of these vulnerabilities may allow a remote attacker to cause a denial-of-service condition

Microsoft Fixes Botched Windows Security Patch Breaking Down Windows Security Apps (Softpedia) The number of botched updates shipped to Microsoft customers across the world has dropped significantly in the last few months, but this doesn't necessarily mean that patches causing headaches have disappeared entirely

Cyber Trends

Why Internet of Things will change cybersecurity forever: Gartner (First Post) Over 20 percent of enterprises will have digital security services devoted to protecting business initiatives using devices and services in the Internet of Things (IoT) by year end 2017, according to Gartner, Inc

Deception may be next big IT security tool, or may be hype (TechTarget) A new report claims that deception may become a big factor in the future of IT security tools, but one expert warns that the efficacy of such tactics can diminish with popularity

What is the True Cost of a Data Breach? It May Not Be that Easy (Digital Guardian) As data breaches big and small continue to flood headlines, measuring the cost of these incidents remains a challenge

Is poor software development the biggest cyber threat? (CSO) The disconnect between software developers and IT security teams has lead to widespread application vulnerabilities

Australian Cyber Security Centre releases first ever public threat report (Clayton Utz) Fewer cyber-attacks on Government systems have been accompanied by a rise on attacks on the private sector

ESET Report: Huge gap in cyber security knowledge leaves Asia vulnerable (ChannelWorld) ESET has released the ESET Asia Cyber Savviness Report 2015 which shows that 93 percent of online users in Asia worry about cyber security

Marketplace

Cybersecurity, One of the Fastest Growing Technology Segments (Market Realist) As the number of cyberattacks on companies rises, companies that conduct their businesses digitally will increase their spending on digital security

How Much Should Firms Pay to Protect Themselves From Hackers? (American Lawyer) The Am Law Daily spoke with a few cybersecurity consultants to find out the ideal amount that large law firms should spend to adequately defend their data from hackers, as well as determine whom they should hire for such a task

Snoopers' Charter will cause extreme rise in business costs (Help Net Security) The UK Government's Investigatory Powers Bill, dubbed 'Snoopers' Charter' by critics, has already been met with contention from tech giants, Google, Facebook and Microsoft, who have stressed they will not voluntarily co-operate with it

Bringing clarity to data breach legislation, enforcement (Security InfoWatch) Given the lack of laws and established court precedents nationally on issues involving cybersecurity combined with the rise of data breaches in recent years, concerns have been growing among security executives as to what the federal government may do to address the subject

VA Seeks Personal ID Credential Mgmt Software Sources (ExecutiveBiz) The U.S. Department of Veterans Affairs is exploring sources of application or software programs that VA can potentially use to verify credentials of employees and contractors who access its facilities

Verint Systems, Inc. (VRNT — $51.67*) Delivers Good July Results, Lowers Outlook — Maintain Outperform (FBR Capital) Last night, Verint delivered good F2Q16 (July) results, as it beat Street expectations on both the top and bottom lines, showing a nice rebound from the softness seen in F1Q16 (April)

Microsoft Corporation (MSFT — $43.36*) Windows 10 + Cloud Momentum = Brighter Days Ahead for Microsoft — Maintain Outperform (FBR Capital) While market volatility and worries about China/overall growth have been overhangs for Microsoft and its tech brethren over the past month, we believe cloud momentum and a healthy Windows 10 uptake out of the gate is setting the stage for a transformational cloud transition for Satya Nadella and company over the next few years

Security Financings Continue Their Heat Wave With A New $75M Round For Netskope (TechCrunch) Netskope, which sells a technology service protecting businesses' cloud-based software, has joined the ranks of the massively funded (and potentially overfunded?) security technology companies with a new $75 million round of financing

MACH37 Announces New Funding for Virgil Security and Cyph (Dark Reading) Angel Investors CIT, Goel Fund, and NextGen Angels invest in two innovative startups

Father And Son Become Billionaires With Tanium, The Hottest Cybersecurity Startup (Forbes) Fathers and sons everywhere can learn a lesson from David and Orion Hindawi

Federal demand for cybersecurity has firm Tanium booming (The Hill) Cybersecurity firm Tanium has raised $120 million in its third round of funding in just over a year, it said Wednesday, as federal demand for its services continues to grow

Bei Digitalisierung ist das Rennen noch offen (Welt) Trotz der Vormacht von US-Konzernen wie Google haben deutsche Unternehmen aus Sicht von Siemens große Chancen bei der Digitalisierung der Wirtschaft

New Strategy Needed to Address Skills Gap (InfoRiskToday) ISACA's Kadam Details New Program to Develop Security Pros

Internet of Things Security Pioneer, Bastille, Expands Executive Team to Launch its Next Stage of Growth (PRWeb) Additions in leadership bring experience scaling fast growing startups

Boston tech firm snags new hires with cybersecurity experience (Boston Business Journal) Carbonite, the Boston-based cloud backup firm, has made two new executive hires with one skill in common: cybersecurity

Products, Services, and Solutions

Cyber attack training center to open near Prague (Prague Post) Cyber-security firm CyberGym seek to train companies in defense

AdaptiveMobile Saves Mobile Operators More Than USD$40 Million Per Year (BusinessWire) Grey Route Controls service protects mobile operators' share of USD $70 billion A2P SMS market

Netflix Sleepy Puppy Awakens XSS Vulnerabilities in Secondary Applications (Threatpost) Most automated scanning and security tools that ferret out cross-site scripting vulnerabilities don't do much analysis beyond the target application. Netflix this week, however, released to open source a tool developed in-house that persists beyond the target app and can flag potential XSS trouble in secondary applications

Webroot Releases Security Toolkit for IoT Devices (eWeek) The toolkit is designed to help protect this next generation of critical systems against external threats and internal vulnerabilities

Smart Verify (TeleSign) A single API that simplifies end-user verification and two-factor authentication (2FA) for online and mobile app-based accounts to help increase completion rates and better manage costs, all while minimizing the development effort needed to get started

HP beefs up enterprise security suite with tools to root out malware, app vulnerabilites (PCWorld) The Fortify app testing service has gained machine learning analysis capabilities

SolarWinds Enables Resource-Constrained Security Teams to Easily Leverage Threat Intelligence (MarketWatch) SolarWinds® Log & Event Manager now integrates log collection with threat intelligence feeds to provide insight into known and proven threats for faster detection

Tanium review: Endpoint security at the speed of now (InfoWorld) Tanium Endpoint Platform draws on fast peer-to-peer communications to answer queries of managed clients within seconds

Kafka announces new features, improves use at LinkedIn, Yahoo, Netflix and more (FierceBigData) LinkedIn engineer Todd Palino called Kafka its "circulatory system for data," and now the company is working to improve the flow of its lifeblood

Die smarte Küche von Siemens ist komplett (Finanznachrichten) Mit connectivityfähigen Geräten bei Kühlen, Kaffee und Wäschepflege bietet die Marke jetzt ein vernetztes Vollsortiment

Resilient Systems' Incident Response Platform to Strengthen EY's Managed Security Operations Center (BusinessWire) Resilient's Incident Response Platform will enable EY clients to respond more quickly and effectively to cyberattacks

Check Point Changes the Malware Game With New Threat Prevention Solution (CNN Money) Check Point SandBlast™ ups the ante in threat defense with evasion-resistant sandboxing and threat extraction

Compliance Software Company Intelleges and Cyber Security Firm Advanced Threat Analysis form Strategic Alliance (BusinessWire) Intelleges, a software company, and cyber security firm Advanced Threat Analysis (ATA) signed a strategic alliance today

Cutting-Edge MSSPs Supercharge their Services with Bit9 + Carbon Black, the Market Leader in Next-Gen Endpoint Security (Nasdaq) More than 25 top MSSPs bring market's most advanced endpoint security solution to 250+ organizations; other MSSPs are 'using slingshots in the fight against advanced threats'

ThetaRay Launches Credit Risk Detection Model for Online Lending Industry (PRNewswire) Increases loan acceptance rates while maintaining acceptable risk levels

Comparing the best SIEM systems on the market (TechTarget) Expert Karen Scarfone examines the best SIEM products on the market to help you determine which one is right for your organization

Technologies, Techniques, and Standards

11 Steps for Building APT Resilience (InfoRiskToday) Experts outline short, long-term plans to respond to new threats

The "Executive" IT Security Problem — Lessons Learned from Hillary Clinton (SecurityWeek) Executives have always been privileged users

Identity Theft 101 — Stop It, Catch It, Kill It: Part 2 (Team Cymru) In our previous post, we discussed what identity theft is, and how to prevent it. But with the best will in the world, criminals are crafty, and mistakes happen

Negligence And Risk: The Imperfect Balance Of Cyber Security (Forbes) Terry Kurzynski is the founder and Senior Partner of HALOCK Security Labs… Terry has pioneered a service philosophy that he calls Purpose Driven Security. This philosophy can best be summarized as measured and preemptive. Together the dual emphasis allows organizations to utilize a limited security budget to maximize protection of their critical information assets

Hedgeweek cybersecurity interview with Options CTO, John Bryant (Hedgeweek) Options Chief Technology Officer John Bryant (pictured) explains how the company is constantly working to stay ahead of the risks posed to the hedge fund industry by cybersecurity issues

Research and Development

A New Design for Cryptography's Black Box (Quanta) A two-year-old cryptographic breakthrough has proven difficult to put into practice. But new advances show how near-perfect computer security might be surprisingly close at hand

New Patent Granted Keypasco in Japan (Keypasco) Keypasco has filed patent applications in all major countries to secure its core software technology, which is the foundation for the Keypasco authentication solution

Unsolved cipher mystery: Spaniard says he's cracked Dead Pigeon code (Naked Security) Back in 2012, a man in the South of England was apparently renovating his chimney when he came across the skeleton of a pigeon

Ashley Madison Hack Creates Ethical Conundrum For Researchers (Huffington Post) Some see it as a "gold mine." Others say it's a minefield

Academia

Loyola University Maryland Receives 2015 Computerworld Data+ Editors' Choice Award for Mastering Data Security With Varonis (Nasdaq) Loyola University Maryland has been named as a 2015 Computerworld Data+ Editors' Choice Award honoree for its use of Varonis (NASDAQ:VRNS), the leading provider of software solutions for unstructured, human-generated enterprise data

Tech joins cyber battle (El Defensor Chieftain) Very few computer systems have proven completely safe from hackers around the globe in recent years

Cybersecurity workshop draws students of various stripes from across state (Daily Lobo) Students, law enforcement officers, military personnel and others are congregating at the Anderson School of Management this week for a seminar about cybersecurity fundamentals, in hopes that they can apply it to their education or careers

Emerging field has huge potential for college and university curricula (eCampusNews) Data analytics is gaining traction as a new career option for college graduates. Here's how one institution is grabbing the opportunity and helping students prepare for jobs in the field

New Marine cyber-security chair to spearhead PME overhaul (Marine Corps Times) A new cyber-security chair at Marine Corps University will oversee the integration of cyber studies into nearly every facet of professional military education for Marines, from lance corporals through senior commanders

Legislation, Policy, and Regulation

Should the US hit China with sanctions over cyberespionage? (Naked Security) China and the United States usually treat each other the way two heavyweight boxers do — circling each other, jabbing occasionally, but never throwing a big punch that could leave them exposed

A new global war front taking shape in cyberspace (CNBC) Looking for ways to thwart hackers, the federal government has budgeted $14B toward cybersecurity for fiscal 2016

Should Government Use 'Dark Web' Data to Warn Industry About Planned Attacks? (Nextgov) When attribution in cyberspace is debated and discussed, most of the focus has been on whether the U.S. government should take an offensive strike against cyberattackers

What Congress Can Learn from the Military About Cybersecurity (Defense One) As it stands, the Cybersecurity Information Sharing Act won't much improve information-sharing. Here's how to change that

OMB's Proposed Guidance Addresses Cyber Risk for Government Information (Legaltech News) New policies will impact government agencies and their contractors

Energy regulators respond to increasing cyber threats to the grid (Lexology) As anyone who even casually watches the nightly news can tell you, breaches of customer and corporate data can cause serious financial, legal, and reputational harm to a company

DISA's new cyber HQ starting to branch out (Defense Systems) The Defense Department's new, centralized office for defending DOD networks, which gained initial operating capability in January, is making progress on taking some of the defensive burden off of the U.S. Cyber Command, according to the vice director of the Defense Information Systems Agency

Who Commands In Cyberspace As New HQ Expands? (Breaking Defense) "Unity of command" is a classic principle of war

Litigation, Investigation, and Law Enforcement

Cybercrime by wire fraud — what's covered? (CSO) Think your cyber liability insurance will protect loss of funds? Read the fine print

Judge wants to push ahead with challenge to NSA's bulk collection of Americans' phone records (US News and World Report) A federal judge said Wednesday he plans to push ahead with a challenge to the National Security Agency's bulk collection of telephone data on hundreds of millions of Americans, even as the program is set to expire at the end of November

Journalists arrested on terrorism charges in Turkey for using crypto software (Ars Technica) Part of much wider trend to demonise encryption, perhaps with a view to banning it

Google accused of rigging search results by India's competition cops (Naked Security) In the competitive playground that is search, Google is the schoolyard bully, 30 companies told the Competition Commission of India (CCI) in response to its recent inquiries

Sony Entertainment reaches settlement with ex-workers affected by 2014 cyber-attack (Raw Story) Sony Pictures Entertainment Inc has reached a settlement agreement with nine former employees who had filed a lawsuit claiming that their personal data was stolen in a 2014 hacking tied to the studio's release of a comedy film set in North Korea, "The Interview"

Staffer who worked on Clinton's private e-mail server faces subpoena (Washington Post) A former State Department staffer who worked on Hillary Rodham Clinton?s private e-mail server tried this week to fend off a subpoena to testify before Congress, saying he would assert his constitutional right not to answer questions to avoid incriminating himself

Report: VA lost 10,000 health applications (Military Times) The Veterans Affairs Department's system for tracking veterans' applications for health care is so unreliable that it's impossible for VA officials to know how many former troops still want care — or even if they are still alive, according to a new report

Reporters face subpoenas in case over CIA head's resignation (AP via Yahoo! News) A couple suing over leaks in the federal investigation that led to CIA Director David Petraeus' resignation intend to subpoena at least two journalists in an attempt to compel testimony about their sources

Man arrested for parodying mayor on Twitter gets $125K in civil lawsuit (Ars Technica) Mayor concerned about being portrayed as drug abuser who hangs with prostitutes

Online drug dealer betrayed by poor opsec pleads guilty to importing molly (Ars Technica) Massachusetts man bought methylone from a sketchy Chinese online vendor

14-year-old added to police database for using Snapchat to send naked selfie (Ars Technica) Criminalized by stupid laws, had he been older, he would have been seen as the victim

For a complete running list of events, please visit the Event Tracker.

Upcoming Events

SCADA Nexus 2015 (Houston, Texas, USA, Sep 2 - 4, 2015) SCADA Nexus is an international annual event for ICS and SCADA security professionals and executives to focus on world-wide security concerns. The event is located in Houston, Texas each year at the Hilton Americas Convention Center. Our 2015 event is from September 2-4 with extended training from September 7-11.

SIN 2015 (Sochi, Russia, Sep 8 - 10, 2015) The 8th International Conference on Security of Information and Networks (SIN 2015) provides an international forum for presentation of research and applications of security in information and networks. SIN 2015 features contributed as well as invited papers, special sessions, workshops, and tutorials on theory and practice. It seeks to convene a high-quality, well-attended, and up-to-date conference on scientific and technical issues of security in information, networks, and systems

NSPW (New Security Paradigms Workshop) (Twente, Netherlands, Sep 8 - 11, 2015) Although NSPW is more of a workshop than a conference, it has earned its right to be included in this list. Since 1992, NSPW has been offering a unique forum for cyber security specialists involved in researching high-risk, high-opportunity paradigms to present their ideas. The discussions always challenge the current limitations of information security tools and technology, while disputing ng-held beliefs or the very foundations of security. You're bound to get fresh, new ideas from attending this workshop

Global Cyberspace Cooperation Summit VI (New York, New York, USA, Sep 9 - 10, 2015) An invitation-only event, this meeting of international actors aims to coordinate and consolidate progress, showcase results and promote collective action. The annual cyber summits provide a crucial forum for building international, private-public action to foster international cooperation in cyberspace. Breakthrough groups, aligned with the initiative's objectives of economic and political development, digital security and stability, and sound governance and management, carry the program forward

Intelligence and National Security Summit (Washington, DC, USA, Sep 9 - 10, 2015) AFCEA International (AFCEA) and the Intelligence and National Security Alliance (INSA) are pleased to host the second Intelligence and National Security Summit to provide the platform for this essential discussion. This two-day, unclassified Summit will feature five plenary sessions with top federal agency leaders and policymakers sharing their assessments and priorities for U.S. national, defense and homeland security intelligence. In addition, thought leaders from government, industry and academia will explore emerging issues and solutions related to intelligence policy, cyber threats, and technology and innovation over nine breakout sessions

Cybersecurity Innovation Forum (Washington, DC, USA, Sep 9 - 11, 2015) The 2015 Cybersecurity Innovation Forum is a three-day event hosted by the National Institute of Standards and Technology, and planned with the National Security Agency, and the Department of Homeland Security. This event brings government and industry together to focus on current, emerging, and future challenges, technologies, projects, solutions, and research in trusted computing, security automation, and information sharing

2nd Annual Senior Executive Cyber Security Conference (Baltimore, Maryland, USA, Sep 10, 2015) The one-day symposium will examine the potential advantages and pitfalls of an information-sharing strategy from the technological, business and regulatory perspectives

Cyber 6.0 (Laurel, Maryland, USA, Jun 17, 2015) The mission of the Cyber Conference is to provide a forum for small and mid-sized businesses in Howard County and the region to access industry and government leaders with current information on cybersecurity that will improve their market position, enhance their corporate security policies and infrastructure, identify potential business opportunities, and provide a take away of information and contacts for follow-up that assists businesses in understanding the role they play in national cybersecurity and how they can address those challenges. All businesses have a role to play in protecting the national security of our infrastructure. While locally sponsored and organized, the conference has national reach

BSides Augusta 2015 (Augusta, Georgia, USA, Sep 12, 2015) Each BSides is a community-driven framework for building events for and by information security community members. The goal is to expand the spectrum of conversation beyond the traditional confines of space and time. It creates opportunities for individuals to both present and participate in an intimate atmosphere that encourages collaboration. It is an intense event with discussions, demos, and interaction from participants. It is where conversations for the next-big-thing are happening

SANS Institute: Information Security Training (Las Vegas, Nevada, USA, Sep 12 - 21, 2015) Information security training in Las Vegas from SANS Institute, the global leader in information security training. At SANS Network Security 2015, SANS offers more than 40 hands-on, immersion-style security training courses taught by real-world practitioners. The site of SANS Network Security 2015, September 12 - 21, is Caesars Palace, the majestic Las Vegas hotel

Gulf Cooperation Council Cyber Security Summit (Abu Dhabi, United Arab Emirates, Sep 13 - 15, 2015) The GCC Cyber Security Summit will bring together regional and international thought leaders and decision-makers to examine one of the most vital threats to the region's future well-being: cyber-attack. Penetration of national and company security, criminal fraud and identity theft are now big business worldwide among a shadowy fraternity that is only growing in power and size. Recent incidents with film studios, healthcare providers and global banks continue to resonate in cabinet offices and boardrooms everywhere

Hacker Halted 2015 (Atlanta, Georgia, USA, Sep 13 - 18, 2015) EC-Council Foundation's flagship information security conference, Hacker Halted, will unite some of the greatest minds in information security, as industry experts address the latest threats and vulnerabilities plaguing the virtual world. Hacker Halted will also feature several highly technical and advanced workshops that cover the most current security topics and will include EC-Council's most sought after certification classes. Hacker Halted runs concurrently with the invitation-only Global CSO Forum

EnergySec 11th Annual Security & Compliance Summit (Washington, DC, USA, Sep 14 - 16, 2015) For more than 10 years the EnergySec Security Summit has been the premier gathering for stakeholders in the energy sector focused on physical and cyber security. Our summits give each attendee a rare opportunity to mingle with asset owners, government agencies, researchers, consultants, vendors and academia under one roof

Fraud Summit San Francisco (San Francisco, California, USA, Sep 15, 2015) ISMG's Fraud Summit is a one-day event focused exclusively on the top fraud trends impacting organizations and the mitigation strategies to overcome those challenges. Among the areas to be discussed are the fraud ecosystem, trends in consumer fraud awareness (what's working and what's not), and threat intelligence

Borderless Cyber 2015 (Washington, DC, USA, Sep 15 - 16, 2015) OASIS, in collaboration with The World Bank, will bring together public and private sector security professionals from around the world to evaluate, debate, and collaborate on cyber security best practices and tools. Hosted at The World Bank headquarters in Washington, DC, the conference will generate dialogue across government and business, combining high-profile guest speakers, interactive roundtable sessions, and moderated debates. Additional networking events will complement each day's agenda, offering opportunities for real-time collaboration

Detroit Secure World (Detroit, Michigan, USA, Sep 16 - 17, 2015) Join your fellow security professional for affordable, high-quality cybersecurity training and education at a regional conference near you. Earn CPE credits while learning from nationally recognized industry experts on many diverse topics such as: Risk Mitigation, Malware Detection, Digital Forensics, Cloud Security, Privacy, Big Data, PCI Compliance, Security Metrics, Encryption, Mobile Device Management, Incident Response, and much more. Risk management and enterprise cyber defense strategies figure among the agends

National Insider Threat Special Interest Group Meeting (Laurel, Maryland, USA, Jul 16, 2015) Topics to be discussed at the meeting; Insider Threat Program Development & Implementation, Behavioral Indicators Of Concern, Legal Considerations When Developing & Managing An Insider Threat Program. There is no cost to attend this meeting

6th Annual Billington Cybersecurity Summit (Washington, DC, USA, Sep 17, 2015) Join key leaders and decision makers from government, military and the private sector at this one-day intensive networking event as participants focus on the next generation of solutions to ensure this nation's cybersecurity

Cyber Security Summit: New York (New York, New York, USA, Sep 18, 2015) The Cyber Security Summit provides an exclusive business environment to meet with Senior Executives who are seeking innovative solutions to protect their business & critical infrastructure. Delegates at the Cyber Security Summit are prequalified based on their willingness to meet with Solution Providers and proven ability to purchase products and services

Data Breach Investigation Summit (Dallas, Texas, USA, Sep 21 - 26, 2015) Data Breaches are occurring at an alarming rate and increasing in their scope, frequency and impact and they don't discriminate by industry, geography or organization size. When a breach occurs, organizations, agencies and individuals need to learn how to more effectively, identify/detect that the breach has occurred, respond to the breach in an effective and timely manner, investigate the breach, and prevent/defend the organization from future breaches

St. Louis SecureWorld 2015 (St. Louis, Missouri, USA, Sep 22 - 23, 2015) Join your fellow security professional for affordable, high-quality cybersecurity training and education at a regional conference near you. Earn CPE credits while learning from nationally recognized industry experts on many diverse topics such as: Risk Mitigation, Malware Detection, Digital Forensics, Cloud Security, Privacy, Big Data, PCI Compliance, Security Metrics, Encryption, Mobile Device Management, Incident Response, and much more. The security implications of the Internet-of-things will be among the topics discussed

OWASP APPSECUSA (San Francisco, California, USA, Sep 22 - 25, 2015) The premier gathering of developers, security experts and technologists to discuss cutting edge approaches to secure web applications

SAT 2015: 18th International Conference on Theory and Applications of Satisfiability Testing (Austin, Texas, USA, Sep 24 - 27, 2015) The International Conference on Theory and Applications of Satisfiability Testing (SAT) is the premier annual meeting for researchers focusing on the theory and applications of the propositional satisfiability problem, broadly construed. Aside from plain propositional satisfiability, the scope of the meeting includes Boolean optimization (including MaxSAT and Pseudo-Boolean (PB) constraints), Quantified Boolean Formulas (QBF), Satisfiability Modulo Theories (SMT), and Constraint Programming (CP) for problems with clear connections to Boolean-level reasoning

CSS (International Conference on Cryptography and Security Systems) (Warsaw, Poland, Sep 25 - 27, 2015) After three years' break, CSS is returning in 2017 with another great look at the evolution of cryptography and its role for the cyber security industry. This event is focused on presenting original and unpublished research and developing activities related to all aspects of cryptography and network security. From theory to practice, this conference might be right up your alley if you're interested in cryptography

Business Insurance Cyber Risk Summit 2015 (San Francisco, California, USA, Sep 27 - 28, 2015) The Business Insurance Cyber Risk Summit provides risk management professionals and chief information security officers with the practical information and tools needed to combat the latest cyber risks that threaten their organizations. The day-long conference will explore cyber exposures, regulations, governance and insurance coverage. Risk managers and CISOs will learn how to adapt proven risk management strategies to their current cybersecurity environments, how to better communicate with their information security teams, and how to effectively convey risks, exposures and coverage options to their corporate boards and the C suite

ASIS International (Anaheim, California, USA, Sep 28 - Oct 1, 2015) The ASIS Annual Seminar and Exhibits boasts of being one of the world's most influential events for security professionals. Its mission is to provide industry-leading education, countless business connections, and the latest product and service innovations from 600+ exhibitors from the information security sector

CYBERSEC European Cybersecurity Forum (Kraków, Poland, Sep 28 - 29, 2015) The CYBERSEC forum is the first of its kind in Poland and one of just a few regular public policy conferences in Europe devoted to the strategic issues of cyberspace and cybersecurity. The goal of CYBERSEC conference is the formulation of practical recommendations that aim to increase resilience to cyber threats within specific economic sectors, countries, and the EU as a whole

(ISC)² Security Congress (Anaheim, California, USA, Sep 28 - Oct 1, 2015) Proudly colocated for the fifth year in a row, (ISC)² Security Congress 2015 and ASIS International 61st Annual Seminar and Exhibits (ASIS 2015) expect more than 19,000 professionals worldwide from both the information security and operational security disciplines to join together September 28 - October 1 in Anaheim, CA. Offering more than 80 education sessions along with networking and career advancement opportunities, (ISC)² Security Congress 2015 will include topics on best practices, current and emerging issues, and solutions to challenges

Cloud Security Alliance Congress at P.S.R. (Las Vegas, Nevada, USA, Sep 28 - Oct 1, 2015) The industry's premier gathering for IT security professionals and executives who must further educate themselves on the rapidly evolving subject of cloud security. Offering best practices and practical solutions for remaining secure in the cloud, CSA Congresses also expose attendees to industry-specific case studies. P.S.R. brings together two industry-leading events — CSA Congress US and the IAPP Privacy Academy — to provide attendees with more than double the education and networking opportunities with leading innovators and practitioners in technology, security and privacy for the price of a single conference. Among the keynote presenters are Arthur W. Coviello, Jr., Executive Chairman (Retired), The Security Division of EMC, RSA, Brian Krebs, Investigative Reporter, Cybersecurity Expert, Travis LeBlanc, Chief of Enforcement, Federal Communications Commission, Lydia Parnes, Partner, Wilson Sonsini Goodrich & Rosati, Jessica Rich, Director, Bureau of Consumer Protection, Federal Trade Commission

Fraud Summit Toronto (Toronto, Ontario, Canada, Sep 17, 2014) From account takeover to payment card fraud and the emerging mobile threatscape, the ISMG Fraud Summit series is where thought-leaders meet to exchange insights on today's top schemes and the technology solutions designed to stop them.

Threat Intelligence Summit 2015 (ChampionsGate, Florida, USA, Sep 29 - 30, 2015) The threat landscape is getting bigger and more complex, the tools more plentiful, the amount of digital information increasingly massive, and the skills needed to navigate this terrain seem to multiply continuously. The key to success in defending against threats — actionable threat intelligence. Threat Intelligence Summit 2015 will address best practices for combating threats in your organization

hardwear.io: Hardware Security Conference and Training (The Hague, Netherlands, Sep 29 - Oct 2, 2015) Do you trust your hardware? Learn from experts about backdoors, exploits, trust, assurance and attacks on hardware equipment, firmware and related protocols

VB2015 (Prague, Czech Republic, Sep 30 - Oct 2, 2015) The VB2015 programme includes 38 papers on a wide range of security topics. As in previous years, the presentations will run in two parallel streams and the programme includes both technical and less technical presentations. Just a small selection of the many highlights includes: "Attack on the drones: security vulnerabilities of unmanned aerial vehicles" (Oleg Petrovsky), "How malware eats cookies" (Zhaoyan Xu, Wei Xu), "The Unbearable Lightness of APTing" (Yaniv Balmas, Ron Davidson, Shahar Tal), "The Kobayashi Maru dilemma" (Morton Swimmer, Nick FitzGerald, Andrew Lee), "DDoS trojan: a malicious concept that conquered the ELF format" (Peter Kalnai, Jaromir Horejsi), "POS fraud: trends and counter-actions to mass fraud" (Ken Dunham), and "The elephant in the room" (Marion Marschalek). This year's conference will include two keynote speakers — one at the opening of the conference and one at the very end. The programme will also include a number of added extras